The threat posture of both networks is quite different. As a user, as you rightly point out, TLS means it doesn't matter to you much! But if you turn it around

The threat posture of both networks is quite different. As a user, as you rightly point out, TLS means it doesn't matter to you much! But if you turn it around and thinks about the problem as a business user, where you have some ancient legacy systems that can't do TLS, you can set up a private APN for authorised users, and connect that APN over a VPN or dedicated private leased line to the insecure service. The mobile network itself has a different set of security assumptions that make this possible. Client isolation by default prevents other devices from probing your device like they can on a wrongly configured wireless LAN. The authentication keys to join the network cannot be stolen by a compromised phone or phone firmware. An authorized user can't let another unauthorized user access the network using credential sharing. Swapping SIM into another device can be detected and the join attempt rejected. Long term authentication secrets sit in hardware protected storage in the SIM and core network - radios and base stations never see long term key material. If you join a roaming network, key material remains secure and the roaming network gets scoped keys that only work on their roaming network. That's not to say any of this is impossible to do with radius and other systems like 802.1x, but it's the default in cellular. As an end user though, TLS is most probably good enough for you, as you say. Put your DNS over TLS and if in doubt use a VPN. A cellular network will offer you much more protection against ARP spoofing by another client device peer, a sensible modern system won't be bothered by this. It's a different threat model and perspective where cellular is more secure - as an individual you might not be too bothered.